Hi,
vm-detection is non-reliable, since detecting based on existance of a virtual mac also triggers when e.g. vmware is just installed on the tested endpoint.
mac based detection must be in relation to standard forwarding network interface.
Updated your code and it now detects correctly.
I could provide a simple patch.